Microsoft Certified: DevOps Engineer Expert (AZ-400) Exam Guide
Validates knowledge of designing DevOps solutions, including source control, build and release pipelines, security and compliance, and instrumentation.
AZ-400 tests whether you can design and implement delivery practices with GitHub and Azure DevOps. Most of the weight is on pipelines, so spend most of your time building YAML pipelines, deployment strategies and infrastructure as code yourself, then practise choosing Microsoft's recommended option among several that would work.
1Understand the exam
Syllabus
Design and implement processes and communications10–15%
Design and implement traceability and flow of work
Design and implement appropriate metrics and queries for DevOps
Configure collaboration and communication
Example scenario: Managers want to see how long work items take from first commit to production. Which metric would you put on the dashboard, and where would the data come from?
Design and implement a source control strategy10–15%
Design and implement branching strategies for the source code
Configure and manage repositories
Example scenario: A secret was committed to a repository three commits ago. What steps would you take to remove it and stop it happening again?
Design and implement build and release pipelines50–55%
Design and implement a package management strategy
Design and implement a testing strategy for pipelines
Design and implement pipelines
Design and implement deployments
Design and implement infrastructure as code (IaC)
Maintain pipelines
Example scenario: A team wants 5% of users to get a new release first, then everyone if error rates stay flat. Which deployment strategy and supporting features would you use?
Develop a security and compliance plan10–15%
Design and implement authentication and authorization methods
Design and implement a strategy for managing sensitive information in automation
Automate security and compliance scanning
Example scenario: A pipeline deploys to Azure with a client secret stored in a variable. How would you remove the stored secret entirely?
Implement an instrumentation strategy5–10%
Configure monitoring for a DevOps environment
Analyze metrics from instrumentation
Example scenario: After a release, response times double for one API. Which telemetry would you check to find the slow dependency?
English, Japanese, Chinese (Simplified), Korean, German, French, Spanish, Portuguese, Chinese (Traditional), Italian
Question types
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
CertUp example
A team wants every pull request to pass unit tests before it can be merged into main. What should they configure?
A branch policy with build validation
A scheduled pipeline run
A release gate on production
A repository tag
Show answer
A. A branch policy with build validation blocks the merge until the pipeline succeeds.
Move items from a list into the correct places, such as matching items to targets or putting steps in order.
CertUp example
Drag each tool to the job it does.
Azure Artifacts
Azure Boards
Application Insights
Show answer
Azure Artifacts → host and share packages; Azure Boards → track work items; Application Insights → monitor application telemetry.
Choose the correct option for each part of an exhibit or statement list, often Yes or No for each statement.
CertUp example
For each statement, select Yes or No.
A YAML pipeline file can live in the same repository as the code it builds.
A variable group can link to secrets in Azure Key Vault.
Branch policies can only be applied to the default branch.
Show answer
Yes, Yes, No. Branch policies can be set on any branch.
Read one scenario with its background, requirements and exhibits, then answer several questions about it.
CertUp example
Case study: A company keeps code in GitHub and deploys to Azure App Service. Requirement: workflows must store no Azure secrets. Question 1 of 3: How should the workflow sign in to Azure?
Workload identity federation with OpenID Connect
A service principal secret in a repository variable
A publish profile committed to the repository
A personal access token
Show answer
A. OpenID Connect lets the workflow request short-lived tokens, so nothing secret is stored.
Complete tasks in a live environment by following written instructions.
CertUp example
In the Azure DevOps project, change the pipeline named Build-Web so it publishes the build output folder as a pipeline artifact named drop.
Show answer
Add a publish pipeline artifact step that points at the output folder with the artifact name drop, run the pipeline and check that drop appears in the run summary.
Eligibility and booking
An Azure Associate certification
Required
Earn Azure Administrator Associate, or hold Azure Developer Associate, to become a DevOps Engineer Expert. You can take AZ-400 before or after it.
Azure Administrator Associate
Pass AZ-104
Azure Developer Associate
Already earned; its AZ-204 exam retired on July 31, 2026
Azure administration and development experience
Recommended
Microsoft expects experience with both, strong skills in at least one, and experience implementing GitHub and Azure DevOps solutions.
Microsoft awards the Expert certification once you have passed AZ-400 and hold one of the listed Associate certifications, in either order.
Schedule AZ-400 with Pearson VUE from the exam page, using a personal Microsoft account. The Expert credential is issued once you also hold a qualifying Associate certification.
Take the free practice assessment to see where you stand, then build each pipeline topic yourself in a free GitHub account and an Azure DevOps organization.
Most candidates spend 60–110 hours. Plan for the low end if you already run pipelines in GitHub Actions or Azure Pipelines; add time if you have used neither.
1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.4 h
3Learn the core conceptsWork through one main course or book, topic by topic.48 h
4Practice with mock examsTake timed practice tests and review every mistake.24 h
5Prepare for exam dayBook the exam and check the ID and delivery rules.4 h
3Learn the core concepts
The free Microsoft Learn paths cover every skill area. Practise in GitHub and Azure DevOps, which both have free tiers.
Build in both tools. The exam covers GitHub Actions and Azure Pipelines side by side. Set up the same pipeline in each so you know where settings such as environments, secrets and approvals live.
4Practice with mock exams
Start with Microsoft's free practice assessment. MeasureUp's official practice test adds timed full-length sets with explanations.
A candidate with two years of daily Azure DevOps work found the scenarios harder than expected, because several answers looked right and only one matched Microsoft's guidance. Their practice scores rose only after reviewing every explanation.
One passer had 45 questions plus an eight-task lab that took almost as long as the rest of the exam. Practise doing tasks in the portal, not only answering questions.
Passers combined free Microsoft videos and the practice assessment with a paid question bank. One experienced engineer was caught out by Maven and npm questions outside their usual toolchain.